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Abstract 

Structural  failures  in  both  commercial  and 
military  aircraft  have  been  the  primary  factor 
that  has  changed  rules  and  specifications  that 
engineers  use  for  design.  In  many  cases,  the 
failures  have  identified  threats  to  structural 
integrity  that  were  not  previously  identified  by 
the  certification  authorities.  Commercial 
failures  have  influenced  the  military 
specifications  and  the  military  failures  have 
influenced  the  commercial  aircraft  rules.  The 
experience  derived  from  the  individual  failures 
is  used  to  describe  the  lessons  learned  and  to 
illustrate  the  evolution  of  structural  criteria  that 
the  United  States  Air  Force  (USAF)  uses  for 
procurement  of  new  aircraft. 

1  Introduction 

Today,  structural  failures  in  USAF  aircraft  are 
extremely  rare.  Except  for  those  failures 
derived  from  exceeding  the  operational 
envelope  of  the  aircraft,  this  was  true  for 
structural  failures  until  after  the  mid-forties. 
One  reason  for  this  is  early  aircraft  rarely 
accumulated  sufficient  flight  time  aircraft  to 
suffer  from  fatigue  failures.  Further,  ductile 
materials  and  conservative  methods  used  for 
analysis  tended  to  preclude  failures.  Therefore, 
the  designers  were  led  to  believe  the  only  threat 
to  structural  integrity  was  failure  resulting  from 
loading  the  aircraft  beyond  its  ultimate  strength. 
The  demand  for  improvements  in  performance 
in  the  late  forties  introduced  new  materials  with 
high  strength,  but  few  other  virtues.  Further,  the 
demand  for  performance  improvements  reduced 
analytical  conservatism  and  introduced  designs 
that  were  to  operate  in  diverse  environments.  In 
some  cases,  the  structural  engineers  needed  to 


design  the  fuselage  for  the  pressure  differential 
at  high  altitudes  and  to  design  the  wings  and 
empennages  to  operate  in  turbulence  dominated 
low  level  regime.  However,  since  they  did  not 
understand  the  implications  of  these 
environments,  they  generally  did  not  properly 
establish  the  design  of  the  aircraft  components 
to  withstand  them.  The  design  community 
appeared  oblivious  to  the  consequences  of 
ignoring  threats  to  structural  integrity  other  than 
overload.  The  success  they  had  experienced 
with  earlier  designs  indicated  to  them  that  they 
were  immune  to  failure  from  fatigue.  Many 
early  textbooks  on  aircraft  structural  analysis 
indicated  the  designers  job  was  complete  when 
they  satisfied  the  static  strength  requirements. 
They  made  no  mention  of  potential  for  fatigue 
failures.  This  omission  resulted  in  grave 
consequences. 

Increased  performance  demands  pressured 
the  design  community  to  design  aircraft  at  too 
high  of  a  stress  for  materials  that  had  marginal 
ductility.  One  of  the  major  failures  resulting 
from  increased  performance  demands  was  the 
Martin  202.  This  aircraft  failed  on  29  August 
1948  from  fatigue  cracking  in  the  wing. 
Another  important  commercial  aviation  failure 
occurred  in  the  Comet  [1],  There  were  two 
failures.  The  first  occurred  10  January  1954  and 
the  second  occurred  on  8  April  1954.  These 
failures  ushered  in  the  requirements  for  fail- 
safety  in  large  commercial  transport  aircraft. 

Another  important  commercial  aircraft 
failure  was  the  Boeing  707  horizontal  tail 
failure.  This  failure  demonstrated  that  structural 
inspections  were  required  in  addition  to  fail-safe 
requirements  resulting  from  the  comet  disasters. 

There  are  many  USAF  aircraft  failures  that 
one  could  use  to  illustrate  important  changes  in 


This  paper  is  a  work  of  the  U.S.  Government  and  is  not  subject  to  copyright  protection  in  the  United  States. 


442.1 


Report  Documentation  Page 


Form  Approved 
OMB  No.  0704-0188 


Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 
VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 


1.  REPORT  DATE 

SEP  2000 


2.  REPORT  TYPE 

N/A 


3.  DATES  COVERED 


4.  TITLE  AND  SUBTITLE 

Effect  Of  Aircraft  Failures  On  USAF  Structural  Requirements 


5a.  CONTRACT  NUMBER 


5b.  GRANT  NUMBER 


6.  AUTHOR(S) 


7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES) 

United  States  Air  Force 


5c.  PROGRAM  ELEMENT  NUMBER 


5d.  PROIECT  NUMBER 


5e.  TASK  NUMBER 


5f.  WORK  UNIT  NUMBER 


8.  PERFORMING  ORGANIZATION 
REPORT  NUMBER 


9.  SPONSORING/MONITORING  AGENCY  NAME(S )  AND  ADDRESS(ES )  10.  SPONSOR/MONITOR' S  ACRONYM(S) 

11.  SPONSOR/MONITOR'S  REPORT 
NUMBER(S) 

12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

Approved  for  public  release,  distribution  unlimited 

13.  SUPPLEMENTARY  NOTES 

See  also  ADM002333.  International  Congress  of  Aeronautical  Sciences  (ICAS)  (22nd)  Held  in  Harrogate, 
United  Kingdom  on  August  27-September  1,  2000.  U.S.  Government  or  Federal  Purpose  Rights  License, 
The  original  document  contains  color  images. 

14.  ABSTRACT 

Structural  failures  in  both  commercial  and  military  aircraft  have  been  the  primary  factor  that  has  changed 
rules  and  specifications  that  engineers  use  for  design.  In  many  cases,  the  failures  have  identified  threats  to 
structural  integrity  that  were  not  previously  identified  by  the  certification  authorities.  Commercial  failures 
have  influenced  the  military  specifications  and  the  military  failures  have  influenced  the  commercial 
aircraft  rules.  The  experience  derived  from  the  individual  failures  is  used  to  describe  the  lessons  learned 
and  to  illustrate  the  evolution  of  structural  criteria  that  the  United  States  Air  Force  (USAF)  uses  for 
procurement  of  new  aircraft. 


15.  SUBIECT  TERMS 


16.  SECURITY  CLASSIFICATION  OF: 


a.  REPORT 

unclassified 


b.  ABSTRACT 

unclassified 


c.  THIS  PAGE 

unclassified 


17.  LIMITATION  OF 

18.  NUMBER 

ABSTRACT 

OF  PAGES 

SAR 

10 

19a.  NAME  OF 
RESPONSIBLE  PERSON 


Standard  Form  298  (Rev.  8-98) 

Prescribed  by  ANSI  Std  Z39-18 


John  W.  Lincoln 


either  standards  or  specifications.  One  of  these 
is  the  F-4  accident  at  Nellis  Air  Force  Base, 
Nevada  on  23  January  1973.  This  failure 
conclusively  demonstrated  to  the  USAF  that  a 
structure  was  not  fail-safe  unless  there  was  an 
inspection  program  designed  to  find  the  broken 
member  before  the  secondary  load  path  failed. 
Another  important  failure  occurred  in  the  T-38 
aircraft  when  the  training  command  changed 
their  usage  dramatically  without  advising  the 
maintenance  center  engineers.  Consequently, 
changes  in  inspection  intervals  were  not 
implemented.  However,  three  aircraft  had 
profound  effect  on  the  way  the  USAF 
accomplishes  its  mission  today.  The  first  is  the 
B-47  that  led  to  the  USAF  Aircraft  Structural 
Integrity  Program  (ASIP).  The  second  is  the 
F-lll  that  led  to  the  adoption  of  damage 
tolerance  in  the  USAF.  The  third  is  the  KC-135 
that  led  to  a  process  for  assessing  widespread 
fatigue  damage  (WFD). 

2  The  B-47 

The  catastrophic  events  leading  to  the 
establishment  of  the  USAF  ASIP  in  1958  [2]  are 
well-documented  [3].  Of  these  events,  the  B-47 
fatigue  failures  stand  out  as  the  most  significant. 
These  problems  crippled  the  main  striking  force 
of  the  Strategic  Air  Command  at  a  time  of 
extreme  world  tension.  The  B-47  and  other 
aircraft  provided  the  hard  lesson  that  aircraft 
designed  based  on  static  strength  alone  would 
likely  not  reach  their  planned  service  life. 

The  prototype  of  the  B-47  made  its  first 
flight  on  December  17,  1947.  The  USAF 
accepted  the  aircraft  based  on  a  static  test  of  the 
B-47B  in  1950  and  started  quantity  production 
in  1951.  There  was  a  flight  load  survey 
demonstration  of  a  B-47B  from  September  1952 
to  March  1954.  When  production  ended  in 
1957,  more  than  1,200  of  these  aircraft  were 
serving  with  the  Strategic  Air  Command  at 
USAF  bases  throughout  the  world.  The  B-47 
normally  carried  a  crew  of  three  -  pilot,  copilot 
(who  operated  the  tail  turret  by  remote  control), 
and  an  observer  who  also  served  as  navigator, 
bombardier,  and  radar  operator.  The  maximum 
mass  of  the  aircraft  was  102,494  kilograms  and 


its  maximum  speed  was  981  kilometers  per 
hour.  It  was  powered  by  six  General  Electric 
J47  engines  each  with  a  thrust  of  32,027 
Newtons.  The  USAF  did  not  specify  a  service 
life,  but  they  intended  to  maintain  the  aircraft  in 
service  until  1965.  The  engineers  based  the 
design  on  the  premise  that  failure  from  overload 
was  the  only  threat  to  its  structural  integrity. 
Fatigue  failures  of  this  aircraft  demonstrated  the 
fallacy  of  this  premise.  On  the  same  day,  13 
March  1958,  in  separate  incidents,  two  of  these 
aircraft  suffered  failure  because  of  fatigue. 
Near  Homestead  Air  Force  Base,  Florida,  a 
B-47B  disintegrated  at  15,000  feet,  three 
minutes  after  takeoff.  Its  center  wing  section 
failed  at  approximately  buttock  line  45.  The 
aircraft  had  a  total  flight  time  of  2,077  hours  at 
the  time  of  failure.  The  same  day,  a  TB-47B 
failed  at  23,000  feet  over  Tulsa,  Oklahoma, 
after  the  lower  left  wing  failed  at  buttock  line 
35.  This  aircraft  had  flown  2,418  hours.  While 
the  USAF  and  the  contractor  were  investigating 
the  two  13  March  accidents,  three  more  failures 
followed.  This  indicated  the  13  March  failures 
were  not  isolated  events.  The  USAF  attributed 
one  of  these  three  to  overload.  They  believed 
the  other  two  were  caused  from  fatigue.  One  of 
these  aircraft  appeared  to  explode  at  13,000  feet 
just  prior  to  a  refueling  rendezvous  near 
Langford,  New  York  on  10  April.  On  15  April, 
a  B-47E  with  a  total  flight  time  of  1,419  hours 
took  off  into  a  storm  from  McDill  Air  Force 
Base,  Florida  and  disintegrated  shortly 
afterwards. 

The  USAF  approached  the  solution  of  this 
problem  through  flight  restrictions,  and  a  test 
program  as  well  as  additional  inspections  and 
instrumentation.  They  placed  flight  restrictions 
on  aircraft  mass,  airspeed,  and  load  factor.  The 
test  program  included  independent  cyclic  tests 
in  three  laboratories.  The  USAF  contracted  for 
these  tests  at  the  Boeing  plant  in  Wichita, 
Kansas,  the  Douglas  plant  in  Tulsa,  Oklahoma, 
and  the  National  Advisory  Committee  for 
Aeronautics  (NACA)  laboratory  at  Langley, 
Virginia.  To  the  surprise  of  the  USAF,  the  test 
at  Boeing  revealed  a  new  fatigue  critical 
location  at  fuselage  station  508.  The  test  article 
failed  after  1,275  cyclic  test  hours.  Although 
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the  USAF  specified  the  laboratories  to  conduct 
the  tests  with  identical  spectra,  there  were 
significant  differences  in  the  test  results.  The 
tests,  however,  served  their  purpose  by 
identifying  areas  that  the  USAF  must  modify  in 
operational  B-47  aircraft.  By  the  late  1960s,  the 
B-47  was  obsolete  and  was  removed  from 
operational  service. 

The  USAF  was  unsure  whether  the  B-47 
failures  indicated  a  chronic  problem  in  all  Air 
Force  aircraft.  To  answer  this  question  the 
USAF  Chief  of  Staff,  General  Curtis  LeMay 
gave  informal  approval  on  June  12,  1958  to 
proceed  with  a  program  called  the  “Aircraft 
Structural  Integrity  Program”  as  proposed  by 
the  Wright  Air  Development  Center  (WADC). 
The  primary  objectives  of  this  program  were  the 
following: 

(a)  Control  structural  fatigue  in  the 
operational  aircraft  fleet. 

(b)  Devise  methods  of  accurately  predicting 
aircraft  service  life. 

(c)  Provide  the  required  design  process  and 
test  techniques  that  would  avoid  structural 
failures  in  operational  aircraft. 

A  later  policy  directive  issued  by  General 
LeMay  on  November  19,  1958  formalized  the 
program.  The  USAF  initially  defined  the  detail 
requirements  in  ASD-TN-6 1-141. 

The  1958  ASIP  included  a  requirement  that 
an  aircraft  be  designed  to  withstand  the  repeated 
loads  expected  during  its  service  life.  As 
validation  that  this  requirement  was  met,  the 
aircraft  was  subjected  to  a  laboratory  (fatigue) 
test  that  simulated  its  expected  service  loading. 
The  period  for  which  the  aircraft  would  be 
declared  safe  to  operate  (the  safe  life)  was  the 
equivalent  flight  time  to  failure  in  the  fatigue 
test  divided  by  a  scatter  factor,  usually  four. 
Therefore,  a  fighter  aircraft,  which  a 
manufacturer  designed  for  an  operational  life  of 
4,000  hours  would  have  to  successfully  pass  a 
laboratory  durability  test  of  16,000  hours. 

The  safe  life  approach  is  based  on 
probabilistic  methods.  The  structural  engineer 
selects  materials  and  designs  individual 
members  of  the  structure  based  on  a  failure  rate 
such  that  operationally  no  failures  are  expected 


within  the  design  service  goal  for  the  aircraft. 
Tests  of  components  representative  of 
production  determine  the  variability  of  the 
quality  of  the  structure  and  consequently  the 
scatter  factor  needed  to  interpret  full-scale 
fatigue  test  results.  Either  the  log  normal 
distribution  function  or  the  Weibull  distribution 
function  is  typically  used  to  represent  the 
reliability  of  the  structure.  The  development  [4] 
of  the  reliability  function  for  the  Weibull 
distribution  function  provides  the  basis  for  the 
reliability  calculation. 

For  aluminum  structures,  the  Weibull 
shape  number  is  typically  in  the  interval  of 
[4. 0,6.0].  Therefore,  if  the  Weibull  shape 
number  is  6.0,  then  the  test  scatter  factor  needs 
to  be  approximately  3.5  to  demonstrate  the 
desired  reliability.  However,  for  high  strength 
steel,  the  Weibull  shape  number  is  in  the 
interval  of  [2. 0,3.0].  For  a  Weibull  shape 
number  of  3.0,  the  test  scatter  factor  may  need 
to  as  high  as  13.0  to  demonstrate  the  desired 
reliability  [5]. 

Data  derived  from  tests  indicate  that,  in 
addition  to  the  material  influence  on  the  Weibull 
shape  number,  there  is  spectrum  content  effect 
on  this  number.  For  example  [6],  test  results 
with  a  fighter  spectrum  appear  to  have  a 
significantly  higher  Weibull  shape  number  than 
test  results  with  a  constant  amplitude  spectrum. 
Further,  it  is  not  possible  to  determine  the 
quality  of  the  test  article  in  relation  to  the 
population  of  production  aircraft.  The  potential 
exists  that  manufacturing  or  service  induced 
damage  in  some  members  of  the  population  may 
violate  the  basic  premise  of  the  reliability 
concept.  All  of  these  influences  make  it 
extremely  difficult  to  determine  the  reliability 
demonstrated  by  the  full-scale  fatigue  test. 

3  The  F-lll 

The  F-lll  was  originally  known  as  the  TFX 
(Tactical  Fighter  "X"),  and  was  conceived  to 
meet  the  USAF  requirement  for  a  new  tactical 
fighter-bomber.  In  1960,  the  Department  of 
Defense  (DoD)  combined  the  USAF's 
requirement  with  a  Navy  need  for  a  new  air 
superiority  fighter,  and  initiated  a  competition 
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among  aircraft  manufacturers  for  the  final 
design.  In  1962,  General  Dynamics  and  Boeing 
were  selected  as  finalists  with  the  General 
Dynamics  TFX  design  eventually  winning. 
DoD  awarded  the  contract  to  them  on  December 
21,  1962,  to  design  and  build  this  aircraft.  The 
USAF  version  was  known  as  the  F-111A  and 
the  Navy  version  the  F-111B.  The  F-111A  was 
powered  by  two  Pratt  &  Whitney  TF30-P103 
turbofans.  The  early  F-111A  engines  had 
extremely  bad  compressor  surge  and  stall 
problems.  The  Navy  was  never  enthusiastic 
about  this  program.  The  F-111B  was  quite 
heavy  for  carrier  operations  and  the  Navy 
cancelled  the  program  when  it  failed  to  meet  the 
requirement  for  handling  on  an  inclined  deck. 
The  first  flight  of  the  F-111A  took  place  in 
December  1964,  and  the  first  production  models 
were  delivered  to  the  USAF  in  October  of  1967. 
The  variable  sweep  wings  were  able  to  move 
from  16  degrees  (full  forward)  to  a  sweep  angle 
of  72.5  degrees  (full  aft).  The  two 
crewmembers  sat  side-by-side  in  cockpit 
module  that  served  as  an  emergency  escape 
vehicle.  Using  internal  fuel  only,  the  plane  had 
a  range  of  more  than  4,000  kilometers.  External 
fuel  tanks  could  be  carried  on  the  pylons  under 
the  wings  and  jettisoned  if  necessary.  The 
USAF  aircraft  was  produced  in  a  variety  of 
models,  including  the  F-111A,  F-111D,  F-111E, 
and  F-111F,  as  well  as  the  FB-111A  strategic 
bomber  version.  The  FB-111A  aircraft  had  a 
1.07-meter  increase  in  wing  span  and  used  the 
TF30-P-7  engine.  In  all,  563  F- Ills  of  all 
series  were  built.  All  of  the  F-llls  had 
numerous  problems,  and  only  the  F-111F 
actually  fulfilled  the  original  TFX  design 
specification.  The  F-111F  had  an  empty  mass 
of  21,367  kilograms  and  a  maximum  takeoff 
mass  of  45,000  kilograms.  The  F-111F  was 
able  to  reach  Mach  1.2  at  sea  level  and  Mach 
2.5  at  60,000  feet.  All  F-l  1  Is  were  retired  from 
the  USAF  inventory  on  27  July  1996. 

The  demand  for  high  performance  from 
this  aircraft  placed  great  demand  on  the 
structural  mass  of  the  aircraft.  The  constraints 
to  produce  a  minimum  mass  design  with  a 
variable  wing  sweep  were  met  with  monolithic 
wing  pivot  and  wing  carry-through  box 


fabricated  from  heat-treated  D6ac  steel  that 
included  welds.  Most  components  were  heat 
treated  to  an  ultimate  tensile  strength  of  1520- 
1660  MPa  with  the  upper  surface  of  the  carry- 
through  box  and  access  door  heat  treated  to 
1790-1930  MPa.  These  components  were 
typically  forged  and  then  welded  into  the 
desired  assemblies.  The  manufacturer 
machined  some  of  them,  however,  from  rolled 
plate  stock. 

However,  the  design,  development,  and 
certification  of  the  F-l  11  structure  followed  the 
principles  defined  in  ASD  TR  66-57  “Air  Force 
Aircraft  Structural  Integrity  Program:  Airplane 
Requirements.”  The  USAF  published  this 
document  following  the  policy  change  resulting 
from  the  B-47  failures.  Consequently,  it  was 
qualified  for  life  through  the  safe  life 
methodology  by  means  of  fatigue  testing.  Many 
failures  slowed  the  testing  of  the  aircraft,  which 
began  in  August  1968.  After  only  a  few 
hundred  hours,  the  wing  carry-through  box 
failed  due  to  fracture  of  a  Taper-Fok  bolt  in  the 
rear  spar  web.  The  investigation  following  this 
failure  led  to  improvements  in  the  installation  of 
these  fasteners.  The  second  failure  occurred  in 
the  wing  carry-through  box  in  February  1969. 
This  failure  occurred  in  a  straight  hole  used  to 
mount  a  bracket.  Inspections  of  23  similar  holes 
in  the  structure  revealed  additional  cracking. 
The  contractor  modified  these  holes  to  accept 
the  fatigue  resistant  Taper-Fok  fastener.  The 
USAF  then  tested  a  new  test  article  that 
incorporated  all  of  the  modifications  from 
previous  test  findings.  This  article  failed  in 
June  1969  with  8,000  equivalent  test  hours.  The 
failure  was  located  in  the  outboard  closure 
bulkhead  of  the  wing  carry-through  box.  A 
simple  modification  eliminated  this  problem. 
The  contractor  continued  testing  successfully 
with  a  new  wing  box  until  the  test  article 
reached  16,000  simulated  flight  hours.  The 
USAF  interpreted  the  test,  in  which  the 
spectrum  was  more  severe  than  expected  in 
operational  service,  as  meeting  a  6,000-hour  life 
with  a  scatter  factor  of  four. 

The  USAF  subsequently  accepted  the 
aircraft  for  operational  service.  On  December 
22,  1969,  F-111A  Number  94  (SN  67-049) 
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crashed  as  a  result  of  a  wing  failure  in  the  lower 
plate  of  the  left  wing  pivot  fitting.  At  the  time 
of  failure,  the  aircraft  had  approximately  100 
hours  of  flight  time.  It  occurred  during  a  pull- 
up  from  a  rocket-firing  pass  at  the  Nellis  Air 
Force  Base,  Nevada  range.  The  USAF 
immediately  grounded  all  F-  111  aircraft  and 
sent  the  failed  part  to  General  Dynamics. 
Metallurgical  examination  showed  that  the 
manufacturing  process  had  produced  a  defect 
that  served  as  a  nucleation  site  for  a  fatigue 
crack.  The  principal  evidence  of  this  was  the 
presence  of  a  decarburized  zone  at  the  surface 
of  the  flaw  and  iron  oxides  on  the  fracture  face. 
These  findings  are  characteristic  of  the  high 
temperatures  associated  with  forging  and  heat 
treatment.  The  metallurgists  believed  that  this 
flaw  was  the  result  of  a  cooling  crack  that 
occurred  after  the  final  forging  cycle. 
Normally,  the  manufacturer  detects  and 
removes  this  type  of  crack  before  proceeding 
with  further  steps  in  the  fabrication  process. 
The  inspection  procedures  used  included 
ultrasonic  pulse  echo  transmission,  conventional 
magnaflux,  and  x-ray.  Because  of  the  size  and 
unusual  geometry  of  the  part,  the  flux  field 
applied  during  the  magnetic  particle  inspection 
was  inadequate  to  cause  the  migration  of  the 
iron  particles  to  the  flaw.  In  addition,  the 
ultrasonic  inspection  could  not  detect  a  flaw 
with  the  orientation  to  the  surface  as  had  existed 
on  the  crashed  aircraft.  X-ray  was  probably 
ineffective  because  of  the  tightness  and 
orientation  of  the  defect.  Consequently,  the 
manufacturer  did  not  detect  this  flaw  as  it 
passed  through  the  fabrication  process. 

The  USAF  established  the  Phase  I 
“Recovery  Program”  in  February  1970  to 
restore  the  fleet  to  80  percent  of  design 
capability.  This  program  included  a  proof  test 
loading  of  each  aircraft  to  design  limit  load 
(+7.33g  and  -2.4g)  at  a  wing  sweep  of  56 
degrees  and  a  temperature  of  -40°  C.  A  USAF 
Scientific  Advisory  Board  Panel  introduced  the 
concept  of  cold  proof  test.  C.  Tiffany,  a 
member  of  this  panel,  had  previously 
successfully  used  cold  proof  testing  in  the  space 
program  for  the  inspection  of  steel  fuel  tanks. 
This  is  an  extremely  useful  tool  for  the 


inspection  of  steel  structures  since  cooling 
reduces  the  fracture  toughness  of  steel. 
Consequently,  the  reduced  fracture  toughness 
reduces  the  critical  crack  size.  Thus,  if  a 
structure  has  a  crack  of  critical  size  at  the 
reduced  temperature,  it  will  fail  under  the  proof 
load  condition.  If  it  does  not  fail,  then  the 
structure  does  not  have  a  crack  of  this  size  or 
greater.  Consequently,  when  the  operating 
temperature  exceeds  the  proof  test  temperature, 
the  number  of  failure-free  flight  hours  may  be 
easily  determined. 

The  USAF  funded  the  building  of  a  proof 
test  facility  at  General  Dynamics  in  Fort  Worth, 
Texas  and  at  the  Sacramento  Air  Logistics 
Center,  California.  The  initial  proof  testing  was 
completed  in  February  1972  on  340 
F-l  1 1  A/D/E  and  FB-1 1 1 A  aircraft. 

The  proof  test  process  was  repeated  after 
approximately  1,500  flight  hours.  Since  the 
proof  test  program  started  in  1970,  there  have 
been  11  major  failures  in  proof  testing.  The 
defects  that  led  to  these  failures  could  have 
caused  an  in-flight  catastrophic  failure.  When 
failures  occurred  during  proof  testing,  the  USAF 
responded  as  if  an  in-flight  failure  had  occurred. 
They  initiated  fleet-wide  inspections  and  made 
modifications  where  appropriate.  These  proof 
test  failures  proved  the  lack  of  validity  of  the 
safe  life  methodology  for  the  steel  alloys  used  in 
this  aircraft.  Each  of  the  aircraft  suffering  a 
proof  test  failure  would  have  experienced  an  in- 
service  failure  in  less  time  than  that  validated  by 
previous  fatigue  testing. 

There  was  some  justification  for  believing 
the  flaw  found  in  the  1969  failure  to  be  unique 
since  the  USAF  could  not  reproduce  the  failure 
in  the  laboratory  and  did  not  see  such  a  failure 
on  another  F-l  11  aircraft.  In  addition,  if  the 
F-l  11  incident  had  been  the  only  failure  of  the 
safe  life  approach,  the  USAF  would  have  likely 
rationalized  the  F-l  11  wing  pivot  flaw  as  a  one- 
of-a-kind  event  and  continued  with  this  method. 
From  other  problems  in  the  USAF  aircraft, 
however,  it  had  become  evident  that  the  safe  life 
methodology  had  not  precluded  the  use  of  low 
ductility  materials  operating  at  high  stresses. 
The  safe  life  also  had  not  recognized  that  any 
single  aircraft  might  have  "rogue" 
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manufacturing  or  service-induced  defects  that 
could  lead  to  premature  failure. 

The  recovery  program  for  the  F-  111  was 
the  first  major  application  of  damage  tolerance 
concepts  to  aircraft. 

The  USAF  significantly  changed  its 
structural  integrity  program  because  of  the 
failure  of  an  F-  111  in  1969.  Up  to  that  time,  the 
USAF  had  been  concentrating  on  improvement 
in  reliability  methods  to  maintain  flight  safety  of 
their  aircraft.  In  addition,  they  were  examining 
the  potential  for  using  the  fracture  mechanics 
based  approach  called  damage  tolerance  [7]. 
The  F-lll  failure  provided  the  basis  for  the 
decision  on  which  path  they  would  take.  It 
ushered  in  the  era  of  damage  tolerance  in  the 
USAF  [8].  The  first  assessments  performed  on 
the  C-5A  and  the  B-1A  in  1971  and  1972  helped 
derive  the  original  damage  tolerance  assessment 
(DTA)  requirements  for  the  USAF.  These 
requirements  were  derived  for  monolithic  (i.e., 
slow  crack  growth)  structures.  The  failure  of  an 
F-4  wing,  previously  mentioned,  also  strongly 
influenced  the  damage  tolerance  requirements 
as  initially  established  in  MIL-A-83444.  The 
technology  for  the  analysis  of  fail-safe  designs 
has  evolved  slowly,  primarily  because  of  the 
need  for  extensive  finite  element  programs 
supported  by  expensive  test  programs.  The 
change  to  a  damage  tolerance  approach 
prompted  considerable  research  and 
development  in  the  area  of  fracture  mechanics. 
At  that  time  Air  Force  Flight  Dynamics 
Laboratory  was  the  focal  point  for  much  of  this 
research.  In  the  sixties  and  seventies,  they 
developed  much  of  the  fracture  technology  that 
is  still  in  use  today.  In  addition,  since  the 
damage  tolerance  approach  forced  the  engineer 
to  better  understand  the  stresses  in  the  structure, 
finite  element  techniques  emerged  as  the 
method  of  choice  for  the  stress  analysis.  These 
capabilities  permitted  the  USAF  to  perform  a 
DTA  of  all  the  major  weapon  systems  in  the 
inventory  in  the  seventies  and  eighties  [9] .  This 
effort  required  over  one  million  man-hours  to 
complete  and  every  major  manufacturer  was 
involved  with  this  activity.  Because  of  this 
activity,  industry  was  able  to  develop  the 
technology  required  for  this  type  of  analysis. 


This  technology  is  also  suitable  for  application 
to  new  aircraft  developments.  Consequently, 
the  USAF  was  able  to  include  damage  tolerance 
requirements  in  the  specification  for  new 
aircraft  procurement. 

The  level  of  safety  afforded  by  the  DTA 
process  has  proven  through  service  experience 
to  be  high.  However,  it  is  evident  that  the 
probability  of  having  an  initial  defect  larger  than 
the  rogue  flaw  is  considerably  less  than 
probability  of  missing  a  significant  crack  in  the 
structure  through  an  inspection.  Therefore,  for 
aircraft  that  are  approaching  a  state  of  general 
cracking  or  their  economic  life,  it  is  prudent  to 
re-examine  the  damage  tolerance  derived 
inspection  intervals  to  determine  if  they  should 
be  reduced.  This  may  be  done  by  means  of  a 
risk  assessment  [10].  Extensive  cracking  is  not 
expected  to  be  a  problem  for  recently  developed 
USAF  aircraft  since  they  were  designed  for  two 
lifetimes  of  slow  crack  growth  from  a  1.27  mm 
initial  flaw.  This  two  lifetime  slow  crack 
growth  guidance  is  included  in  the  JSSG  2006 
specification  guide  for  structures. 

A  number  of  benefits  have  been  derived 
from  the  DTA  process.  One  of  the  more 
significant  benefits  is  that  it  has  placed  the 
USAF  in  an  active  mode  of  problem 
identification  rather  than  the  reactive  mode  that 
prevailed  in  the  sixties  and  early  seventies.  This 
has  permitted  the  Air  Logistics  Centers  to  make 
long  range  plans  for  inspections  and 
modifications  of  their  aircraft.  Further,  the  Air 
Logistics  Centers  now  have  specific  inspection 
requirements  (i.e.,  the  how,  when  and  where  to 
inspect).  Consequently,  the  logistics 

community  has  enthusiastically  embraced  the 
DTA  process.  This  acceptance  has  significantly 
enhanced  its  success. 

4  The  KC-135 

The  KC-135,  a  tanker  aircraft  that  followed  the 
KC-97,  was  designed  to  refuel  the  B-52  fleet. 
The  KC-135  was  derived  from  an  aircraft 
designated  as  the  367-80  developed  by  the 
Boeing  Company  with  their  own  funds.  The 
Boeing  707  and  720  were  also  derived  from  the 
367-80  design.  The  first  flight  of  a  KC-135 
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occurred  31  August  1956.  Five  other 
configurations  of  this  aircraft  were  delivered 
before  production  was  terminated  in  1965  after 
820  aircraft  had  been  manufactured.  Thirty- 
seven  different  designations  of  the  -135  aircraft 
now  exist.  The  maximum  takeoff  mass  is 
146,285  kilograms  and  the  fuel  transfer  load  is 
90,719  kilograms.  It  is  powered  by  four 
CFM-International  F108-CF-100  turbofan 
engines  in  the  KC-135R  configuration  and  four 
Pratt  &  Whitney  TF-33-PW-102  turbofan 
engines  in  the  KC-135E  configuration.  The 
thrust  for  the  CFM  engine  is  996,233  Newtons 
and  80,068  Newtons  for  the  TF-33  engine. 

The  KC-135  did  not  have  a  design  service 
life  originally  specified.  In  1962,  the  USAF 
made  a  decision  to  perform  a  fatigue  test  to 
better  quantify  the  expected  life.  This  test  was 
conducted  to  failure  of  the  wing  at  55,080  test 
hours  of  a  tanker  mission  of  5.1  hours.  Based 
on  this  test,  it  was  believed  that  a  service  life  of 
13,000  hours  could  be  achieved  if  certain 
modifications  were  performed.  These 
modifications  consisted  of  reworking 
approximately  2,000  fastener  holes. 

Contradictory  to  the  1962  fatigue  test 
results,  the  KC-135  aircraft  experienced  service 
problems  early  in  its  life.  The  7178-T6  lower 
wing  skins  were  designed  with  stresses 
approximately  fifty  percent  higher  than  the  707 
aircraft  which  had  the  higher  toughness 
2024-T3  alloy  for  the  lower  wing  skins. 
Consequently,  aircraft  operating  between  1,800 
and  5,000  flight  hours  had  experienced  fourteen 
cases  of  unstable  cracking  in  the  lower  wing 
skins.  In  all,  there  have  been  approximately 
thirty  cases  on  unstable  cracking  in  the  range  of 
1,800  to  17,000  flight  hours.  The  longest  of 
these  cracks  was  approximately  1.1  meters. 

In  addition  to  these  problems,  by  1968,  it 
had  become  evident  that  a  service  life  of  13,000 
hours  would  not  be  adequate  for  this  aircraft. 
Therefore,  in  1972,  another  fatigue  test  was 
performed  to  determine  the  actions  required  for 
extending  the  life  beyond  13,000  flight  hours. 
This  test  was  significantly  more  sophisticated 
than  the  earlier  1962  test  and  was  more 
representative  of  actual  force  usage.  One  of  the 
main  differences  was  in  the  application  of  high 


loads.  The  1962  test  included  an  application  of 
ninety  percent  of  limit  load  every  200  flights. 
The  1972  test  included  the  application  of  sixty- 
two  percent  of  limit  load  every  200  flights. 
Because  of  the  retardation  effect  of  the  ninety 
percent  limit  load  application,  the  1972  test 
exhibited  earlier  and  more  cracking  than 
exhibited  by  the  1962  test.  In  fact,  367  cracks 
were  found  in  the  1962  test  article  and  1060 
cracks  were  found  in  the  1972  test  article. 
However,  as  with  the  1962  test,  there  was  poor 
time  correlation  of  the  cracks  occurring  on  the 
fatigue  test  article  and  those  occurring  in 
operational  aircraft.  The  wing  of  the  1972  test 
article  failed  catastrophically  at  55,505  cyclic 
test  hours.  Based  on  the  results  of  the  1972  test, 
the  USAF  determined  that  the  lower  wing 
surface  would  need  to  be  replaced  at  13,000 
equivalent  tanker  hours.  The  results  of  this  test 
also  alerted  them  to  the  possibility  that  the  fail 
safety  of  the  wing  structure  could  be  degraded 
by  the  presence  of  WFD  [11]. 

Since  some  aircraft  were  near  or  already 
over  the  threshold  of  13,000  equivalent  tanker 
hours,  a  decision  was  made  to  replace  the  lower 
wing  surface  on  these  aircraft.  Further,  since 
the  only  available  design  at  that  time  was  the 
original  7178-T6  wing,  that  material  was  used 
for  the  replacement.  This  was  done  for  twenty- 
nine  wings.  This  replacement  was  questionable 
because  it  was  accomplished  with  the  same 
brittle  material.  However,  it  is  likely  that  it  did 
enhance  the  safety  of  the  aircraft  and,  in 
addition,  provided  wings  for  teardown 
inspections. 

The  teardown  inspections  of  six  wings 
removed  for  a  wing  skin  replacement  served  as 
the  basis  for  an  assessment  of  the  influence  of 
crack  pairs.  A  crack  pair  was  defined  as  a 
primary  and  secondary  crack  located  such  that 
an  unstable  primary  crack  could  cause  the 
secondary  crack  to  go  unstable  and  therefore 
precipitate  catastrophic  failure  of  the  wing.  In 
other  words,  the  assessment  was  made  for 
determining  the  degradation  of  the  fail  safety  of 
the  wing  because  of  WFD.  Finite  element 
analyses  of  the  wing  have  shown  that 
approximately  twenty  fastener  holes  are 
subjected  to  significantly  higher  stresses  in  the 
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event  of  failed  skin  element.  If  there  were  a 
crack  of  one  millimeter  in  one  of  these  fastener 
holes  then  the  residual  strength  would  have  been 
reduced  to  a  level  considerably  below  limit 
load.  A  risk  analysis  for  the  wing  was 
conducted  by  R.  Meadows  from  the  Oklahoma 
Air  Logistics  Center  located  at  Tinker  Air  Force 
Base,  Oklahoma.  The  database  included  245 
cracks,  each  of  which  were  1.27  millimeters  or 
longer  in  length.  In  addition,  29  crack  pairs 
were  found  which  for  the  purposes  of  this  study 
were  defined  as  1.27  millimeters  in  length  for 
the  primary  crack  and  0.254  millimeters  in 
length  for  the  secondary  crack.  Meadows  used 
the  most  critical  crack  pair  from  each  aircraft 
for  his  evaluation.  The  results  of  this 
examination  showed  that  the  mean  time  for  a 
crack  pair  to  develop  was  10,709  to  15,441 
flight  hours  with  ninety  five  percent  confidence. 
Based  on  these  results,  Meadows  performed  a 
risk  assessment  and  found  that  by  the  time  the 
fleet  of  aircraft  had  reached  a  life  of  13,000 
flight  hours,  he  expected,  at  best,  one  loss  and, 
at  worst,  fourteen  losses.  He  also  concluded 
that  the  degradation  of  fail  safety  started  at 
about  11,000  flight  hours. 

Another  teardown  inspection  of  an  aircraft 
with  11,558  flight  hours  indicated  multiple 
crack  alignment  at  the  Wing  Station  360  splice. 
Boeing  determined  that  this  splice,  which  is  a 
known  area  of  high  stress,  would  have  failed 
catastrophically  with  the  application  of  seventy 
percent  of  limit  load.  In  December  1976,  a 
VC-135B  was  in  the  depot  for  replacement  of 
the  lower  wing  surface  when  it  was  found  that 
the  rear  spar  chord  in  the  center  section  was 
severed  and  there  were  adjacent  wing  skin 
cracks.  This  aircraft  had  12,400  flight  hours. 
Further  teardown  inspections  of  wings  that  had 
been  in  service  8,000  to  10,000  hours  revealed 
that  there  were  aircraft  in  the  fleet  that  were 
exhibiting  more  WFD  than  that  found  in  the 
population  examined  by  Meadows. 
Consequently,  the  recommendation  was  made 
that  the  lower  wing  surface  should  be  replaced 
between  8,000  and  9,000  flight  hours  and 
restrictions  should  be  placed  on  aircraft  that 
were  operating  above  8,500  flight  hours.  The 


replacement  was  successfully  performed 
without  loss  of  an  aircraft. 

WFD  is  a  major  concern  in  aircraft  since  it 
can  destroy  the  fail-safety  that  the  operator 
relies  on  to  maintain  structural  integrity.  This 
phenomenon  has  occurred  on  many  aircraft, 
both  military  and  commercial.  The  USAF  has 
learned  WFD  can  degrade  the  fail-safe 
capability  of  a  structure  with  cracks  that  are  of 
the  order  of  one  millimeter  in  length  [12]. 

The  onset  of  WFD  in  a  structure  is 
characterized  by  the  simultaneous  presence  of 
cracks  at  multiple  structural  details,  which  are 
of  sufficient  size  and  density  whereby  the 
structure  will  no  longer  meet  its  damage 
tolerance  requirement.  This  means  that  the 
structure  is  incapable  of  maintaining  its  required 
residual  strength  after  partial  structural  failure. 
In  many  cases,  this  deterministic  definition  is 
difficult  to  apply  because  of  the  complex 
cracking  scenarios.  Further,  this  definition  may 
lead  to  an  excessively  conservative 
determination  of  the  time  of  onset  of  WFD.  An 
alternate  definition  that  removes  these  problems 
is  the  following:  The  onset  of  widespread 
fatigue  cracking  is  that  point  in  the  operational 
life  of  an  aircraft  when  the  damage  tolerance  or 
fail-safe  capability  of  a  structure  has  been 
degraded.  The  degradation  is  such  that  after 
partial  structural  failure  the  probability  of 
failure  of  the  structure  falls  below  the  thresholds 
specified  by  the  procuring  (or  certification) 
agency. 

For  the  USAF,  the  threshold  single  flight 
probability  of  failure  for  the  intact  structure  is 
107.  The  USAF  has  determined  the  threshold 
for  the  conditional  single  flight  probability  of 
failure  through  their  perception  of  the  discrete 
source  damage  threat.  In  the  case  of  the  C-5A, 
they  assumed  the  probability  of  discrete  source 

_3 

damage  was  10  [12].  For  the  case  of  the  707 

-4 

they  assumed  it  was  10  [11]. 

One  of  the  primary  inputs  to  the  risk 
assessment  approach  to  determine  the  onset  of 
the  time  to  WFD  is  the  distribution  of  cracks  in 
the  structure.  The  USAF  has  determined  this 
distribution  through  teardown  inspections  of 
full-scale  fatigue  test  articles  or  operational 
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aircraft.  They  believe  this  is  the  best  method 
currently  available  to  obtain  the  data  required  to 
derive  the  probability  distribution  function  for 
equivalent  initial  cracks  in  the  critical  areas  of 
the  structure.  The  word  "critical"  here  refers  to 
an  area  that  could  significantly  contribute  to  the 
probability  of  failure. 

The  probabilistic  approach  also  requires 
the  stress  density  function  for  each  critical  area 
is  determined.  The  USAF  derives  this  function 
from  the  available  usage  information  generated 
by  their  individual  aircraft  tracking  programs. 
The  desired  stress  density  function  is  the  one  for 
a  single  flight  of  an  aircraft  selected  at  random. 
The  structural  analyst  can  easily  derive  this 
function  from  the  stress  exceedance  function 
developed  as  a  part  of  the  deterministic  damage 
tolerance  analysis.  One  can  then  compute  the 
joint  probability  distribution  of  cracks  and  stress 
and  integrate  this  function  over  the  point  set 
where  the  crack  size  has  reached  critical  length. 
The  result  of  this  calculation  is  the  single  flight 
probability  of  failure.  The  time  at  which  the 
probability  of  failure  is  unacceptable  is  the  onset 
ofWFD. 

Therefore,  the  USAF  considers  the  cracks 
in  the  structure  and  the  stresses  at  the  critical 
locations  as  random  number  sets.  The  crack 
growth  function  and  the  residual  strength 
function  are  also  random  functions  because  of 
the  intrinsic  variability  of  the  material 
properties.  Fortunately,  the  variability  of  the 
crack  growth  and  residual  strength  functions 
does  not  appear  to  have  a  major  impact  on  the 
risk  of  failure.  Therefore,  the  analyst  uses  his 
best  estimate  of  the  mean  of  these  functions  in 
the  risk  assessment. 

The  damage  scenarios  in  an  airplane  that 
could  constitute  WFD  differ  depending  on 
location  in  the  aircraft.  However,  typically, 
they  fall  into  two  categories.  The  first  of  these 
is  multiple  site  damage  -  characterized  by  cracks 
in  multiple  details  in  the  same  structural 
element.  The  second  is  multiple  element 
damage  where  there  are  cracks  in  multiple 
structural  elements. 

Previous  efforts  have  shown  the  analyst 
can  readily  apply  this  type  of  analysis  to  the 
structures  where  the  concern  is  multiple  element 


damage.  This  was  the  case,  for  example,  for  the 
KC-135  and  the  C-5A.  The  application  of  the 
risk  assessment  technology  to  the  case  of 
multiple  site  damage  is  very  much  the  same  as  it 
is  for  the  case  of  multiple  element  damage.  In 
the  case  of  multiple  site  damage  there  will 
typically  be  a  "boundary"  that  will  determine  if 
the  cracking  has  the  potential  to  become 
catastrophic.  For  example  in  the  case  of  the 
fuselage  lap  splice,  the  boundary  would  be  the 
crack  stopper  built  into  the  structure  at  the 
frame  or  between  the  frames  and  its  surrounding 
structure.  This  crack  arrest  feature  protects  the 
integrity  of  the  structure.  The  condition  of  the 
crack  stopper  and  its  surrounding  structure  (that 
is,  the  boundary)  will  determine  if  the  damage 
could  propagate  to  catastrophic  failure. 
Therefore,  the  interest  is  primarily  in  the 
degradation  of  the  boundary  with  time  and  not 
the  growth  of  the  holes  in  the  lap  splice  to  link¬ 
up.  Therefore,  multiple  site  damage  may  be 
evaluated  in  the  same  manner  as  multiple 
element  damage.  Lockheed  [13]  demonstrated 
an  example  this  of  this  in  their  risk  assessment 
on  of  the  inner  to  outer  wing  joint  of  the  C-141 
aircraft. 

Emphasis  must  be  placed  on  the  detection, 
through  nondestructive  evaluation,  of  cracks 
that  could  be  significant  for  determination  of  the 
onset  of  WFD.  As  indicated  above,  there  is  a 
need  to  make  an  estimate  of  this  onset  based  on 
probabilistic  assessment  of  cracking  data 
derived  from  the  teardown  inspection  of  fatigue 
test  articles  or  operational  aircraft.  The  analyst 
must  recognize,  however,  that  this  is  only  an 
estimate.  It  is  not  realistic  to  expect  analyses  to 
determine  this  time  with  great  accuracy  even 
with  the  most  sophisticated  fracture  mechanics 
programs.  The  actual  time  may  be  either 
somewhat  earlier  or  later  than  this  estimate.  It 
is  important,  therefore  to  be  able  to  validate  this 
prediction  with  nondestructive  evaluation.  This 
is  difficult  because  the  size  of  defect  the 
inspector  must  find  is  quite  small.  As  indicated 
above,  the  experimental  evidence  to  date 
indicates  cracks  of  the  order  of  one  millimeter 
can  significantly  lower  the  fail-safety  capability 
of  certain  structural  configurations. 
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5  Conclusions 

The  USAF  ASIP  as  originally  conceived  after 
the  B-47  failures  did  not  accomplish  its  goal  of 
ensuring  safety  of  operational  aircraft.  They 
learned  that  the  use  of  the  reliability  approach 
they  adopted,  led  to  catastrophic  loss  of  aircraft 
and  was  a  large  economic  burden  to  correct 
mistakes  made.  In  hindsight,  they  realized  that 
an  accurate  determination  of  the  reliability 
could  not  be  ascertained  through  this  approach. 
In  response  to  the  problems  with  probabilistic 
methods  for  ensuring  safety,  they  moved  into  a 
more  deterministic  approach  with  the  adoption 
of  damage  tolerance.  However,  damage 
tolerance  is  not  completely  removed  from 
probabilistic  methods.  The  reason  is  that  the 
approach  requires  that  determination  of  the 
initial  flaw  size  for  the  damage  tolerance 
calculations  and,  in  addition,  the  inspection 
capability  is  based  on  a  probability  of  detection 
of  0.9  with  a  95  percent  confidence.  Experience 
has  shown  that  damage  tolerance  inspections 
may  not  preclude  widespread  fatigue  damage  in 
an  aircraft.  The  most  logical  approach  to 
determine  when  in  the  life  of  an  aircraft  when 
this  problem  occurs  is  to  use  probabilistic 
methods.  Consequently,  probabilistic  methods 
have  an  extremely  important  role  to  play  in 
achieving  safe  and  economic  operation  of  an 
aircraft.  However,  their  limitations  must  be 
clearly  understood  so  that  they  will  be  used 
appropriately. 

On  the  positive  side,  one  could  conclude 
from  the  examples  that  the  USAF  does  learn 
from  its  mistakes.  On  the  negative  side,  one 
could  conclude  that  it  takes  a  major  catastrophic 
failure  or  an  economic  disaster  to  make  the 
USAF  act.  A  common  thread  among  all  of  the 
failures  is  that  structural  integrity  is  very  fragile, 
and  mistakes  can  compromise  it  quite  easily. 
Usually,  the  reason  for  mistakes  is  that  the 
designer  is  unaware  of  the  threats  to  structural 
integrity  or  does  not  consider  them  in  the  design 
process.  The  USAF  is  fortunate  to  have 
formalized  the  current  version  of  the  ASIP. 
This  process,  when  followed,  has  been  the  key 
to  virtual  elimination  of  failures  from  strength, 
stiffness,  or  fatigue  causes. 
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